Apache APISIX - Authentication Bypass (CVE-2022-24112)

CVE-2022-24112 is a critical vulnerability in Apache APISIX that allows attackers to exploit the batch-requests plugin to bypass IP restrictions on the Admin API, potentially leading to remote code execution when default configurations are used. This flaw enables unauthenticated attackers to circumvent security controls and gain unauthorized access, posing a significant risk of system compromise and data exposure.

CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2022-24112 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-24112 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-24112 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the /apisix/batch-requests endpoint to send crafted requests that abuse the batch-requests plugin, often including the X-Real-IP: 127.0.0.1 header and targeting internal admin routes such as /apisix/admin/routes/index with a default or known API key to achieve remote code execution.